REGULATIONS FOR SALES PAID BY CARD SALES IN SHOP (Card Present) (May 2015)

Transcription

1 REGULATIONS FOR SALES PAID BY CARD SALES IN SHOP (Card Present) (May 2015) These regulations, the "Shop Regulations", apply to sales paid by Card through the use of a Terminal. The Shop Regulations comprise a supplement to the General Terms and Conditions for the Redemption of Card Transactions (the "Master Document") that have been entered between the Merchant and Euroline. In the event of discrepancies between the Master Document and the Shop Regulations, the Shop Regulations shall take precedence. Words that begin with an upper case letter, that is, a capital, are words that have been assigned special significance/definitions in the Master Document and in these Shop Regulations such words shall have the same meaning as in the Master Document. 1. Checks In conjunction with accepting payment, the Merchant shall conduct the checks specified below. 1.1 The Card In cases where (i) the information on the Card is read without the involvement of the Merchant and (ii) the Cardholder signs the Transaction with a PIN code, the checks specified in section 1.1 below need not be conducted. The same applies if the information on the Card is read without the involvement of the Merchant and the type of Card does not require any further action/acknowledgement of the Transaction than the actual reading of the information. The Merchant shall visually inspect the card to check that: The Card has been signed by the Cardholder; The Card bears no sign of alteration; The Valid thru date specified on the Card has not expired; When identification is presented, the name embossed on the Card is the same as the name on the identification; and The Card is adorned with a brand, compare with section 1 ("Cards") of the Master Document, that is covered by the Agreement. Should any of the above conditions not be met, the Card may not be accepted as a means of payment. 1.2 Identification check An identification check is not conducted if the Card is issued by a foreign card issuer or if the Cardholder identifies him- or herself by PIN code. If the purchase sum exceeds SEK two hundred (200) and the Card is issued by a Swedish card issuer, the Cardholder shall identify him- or herself with identification that is accepted by the Swedish Post Office and/or Swedish banks. Details of the type and number of the identification shall be specified on the signature receipt. If no identification can be provided, the Card may not be accepted as a means of payment. 1.3 Signature The Merchant need not check the signature if the Cardholder signs the Transaction by PIN code (see section 3 below). The Merchant shall compare the Cardholder's signature on the signature receipt with those on the Card and the identification. If the different signatures do not match the Card may not be accepted as a means of payment.

2 1.4 Authorisation and blacklist checks Authorisation checks shall always be made in conjunction with payment, regardless of the purchase sum. If authorisation and blacklist checks are not conducted electronically from the Terminal, the Merchant shall contact Euroline over the phone for approval before processing the Transaction. Euroline provides approval in the form of a control number that must be noted on the signature receipt. Cards on which names and/or numbers are not embossed (such as Cards branded Maestro and Electron), however, require that authorisation is always provided electronically. Transactions may not be processed if neither the magnetic stripe nor the Card's chip can be read for any reason. If when authorising the transaction the Merchant receives the response that the Card is blacklisted, or if it is apparent that the Card is being used by an unauthorised person, if possible the Merchant shall retain the card. The Merchant shall then cut the Card in two and send it to Euroline. When checking the status of the Cardholder's Card (card status check) a so-called "zero value authorisation" shall always be used. 1.5 Chip and PIN Terminals Terminals that are used to process Card transactions shall support magnetic stripe reader and EMV chip technology. MasterCard and VISA may charge Euroline a fee if the Merchant breaches the above. In such cases, under the Master Document the Merchant is obligated to compensate Euroline for such fees. 1.6 Terminals with support for contactless payments As of 1 January 2016, all newly installed terminals at merchants that have not previously accepted Cards must support contactless payments. This even applies to merchants that replace all of their card readers. As of 1 January 2020, all terminals must support contactless payments. 1.7 Chip No CVM Chip No CVM means that the Cardholder does not need to identify him- or herself with either a signature or a PIN code. Such transactions may not amount to more than SEK two hundred (200). This function may not be offered in new installations and may only be used until 29 February Chip No CVM transactions are limited to: Public transport, including ferries (MCC 4111) Passenger railways (MCC 4112) Bus services (MCC 4131) Lunch restaurants (MCC 5812) Fast food restaurants and fast food and drink sales at sports events (MCC 5814) Newspaper sellers and newsagents (MCC 5994) Chip No CVM may not be used for cash withdrawals. The Terminal used for Chip No CVM transactions must be fully able to process Chip and PIN transactions and all current/requisite security procedures. Should any of the conditions of section 1.1 above not be met, the Merchant is liable for all risks associated with fraudulent transactions and Chargebacks. Chip No CVM may only be used in Sweden. 2. Receipts 2.1 Signature receipt contents The Merchant's copy of the signature receipt shall include the following information: The Merchant's name, location and corporate ID number;

3 The Merchant's customer number at Euroline; The date and time of the Transaction; The Card Number (in truncated format if supported by the Terminal); The transaction type (payment or return/credit) in plain text; Control number (proof of authorisation); Currency and amount; Information on value added tax; The text: "Authorised to debit my account as specified above" (this does not apply when a PIN code is used); Space for the Cardholder's signature (this does not apply when a PIN code is used); Number and type of identification (this does not apply when a PIN code is used); and Reference/tracing number (unique identifier for the Transaction). 2.2 The Cardholder's copy The Cardholder shall receive a copy of the signature receipt that includes the same information as the Merchant's copy of the signature receipt. However, the following differences apply to the Cardholder's copy: The Card Number shall be specified in truncated format. The text "card payment" need not be specified (this is only required if the copy of the signature receipt comprises an extended point of sale receipt). The text "PIN code" need not be specified (this is only required when a PIN code is used). The text "Authorised to debit my account as specified above" need not be specified. The Merchant's customer number at Euroline may not be specified. 2.3 Storage The Merchant shall for at least eighteen (18) months archive the signature receipt and the PIN code log in accordance with the applicable rules for PCI DSS (see section 6.1 below). If requested by Euroline, the Merchant shall be able to provide a receipt for an individual Transaction within five (5) days. This applies even if the Merchant's redemption agreement with Euroline has otherwise come to an end. 3. Use of PIN The amount shall be known to the Cardholder when the PIN code is entered. The entering of the PIN code comprises the Cardholder's authorisation for the transaction to be charged to the Cardholder's account. In certain environments, following special agreement Euroline can approve another procedure. The Cardholder shall be given three (3) attempts to provide the correct PIN code. The Cardholder shall be able to cancel a Transaction instead of making further PIN code attempts. In a manual processing environment, the Cardholder shall have the right to refrain from using his or her PIN code to instead sign a signature receipt (on the condition that PIN code transactions are not obligatory for the concerned Card). In the scenarios presented below, a written signature must be provided and as such the Cardholder may not be asked to use his or her PIN code: Authorisation cannot be granted electronically; Use of a PIN code, in accordance with Euroline's Instructions, is not permitted for the concerned Card; The Card Number has been registered manually, that is, the Card could not be read by machine; or Returns/credits. 4. Collecting transactions

4 4.1 Collecting in general Card payment transactions may only be collected using a Terminal. 4.2 Terminal The Card shall be read by machine in the Terminal. If this is not possible due to a problem with the Card, Euroline can provide special permission to register the Card Number and Valid thru date manually. In such situations the Merchant must be able to prove that the Card was present in conjunction with payment, such as with an imprint of the Card or a photocopy of the front of the Card. The photocopy or other proof shall be kept together with the corresponding signature receipt in a manner that is in agreement with the PCI regulations. However, manual registration is never permitted for a Card on which the name and/or number is not embossed (such as Cards branded Maestro and Electron). 5. Reporting 5.1 Submitting payment transactions Electronically collected payment transactions shall be transferred to Euroline within two (2) days of the date of payment. The "date of payment" is the date of authorisation. For environments such as hotels where so-called pre-authorisation is used payment transactions shall be submitted to Euroline within thirty (30) days. 5.2 PIN code log The Merchant shall keep a special log detailing all Transactions for which a PIN code was used, that is, both processed and cancelled Transactions. This log shall show: How the Transaction was processed; The Merchant's name (trading name), location and corporate ID number; The date and time; The Card Number (in truncated format if supported by the Terminal); The payment method (see section 1.1 above); The transaction type (payment or return/credit) in plain text; Point of sale identifier; Control number as proof of authorisation; Currency and amount; Reference/tracing number; and Response code. 5.3 Cash withdrawal in conjunction with payment (so-called cashback) The withdrawal of cash in conjunction with a Card payment may only be made in an amount totalling a maximum of SEK two thousand (2,000). Authorisation and verification by PIN code (alternatively verification by identification check) shall always take place before cash is paid out. Cashback may only take place when the Card has been checked electronically and only in Swedish kronor (SEK). Cashback may only take place in Sweden. 6. Security 6.1 Processing Cardholder Data In order to on the one hand maintain a high level of security in global card payment systems and on the other strengthen trust in Cards as a means of payment, it is of the utmost importance that everyone who processes Cardholder Data does so in a secure manner. "Cardholder Data" refers to such information that is embossed or printed on the front and back of the Card, including information that is stored in the Card's magnetic stripe and chip. For these reasons, the Payment Card Networks have agreed to a common standard for processing Cardholder Data. The standard is called the Payment Card Industry (PCI) Data

5 Security Standard (DSS) and has been established by the international payment card networks Visa and MasterCard. The Merchant agrees to comply with the PCI DSS as currently published at System approval Terminals that deliver Transactions to Euroline shall be approved by Euroline, or by a third party designated by Euroline. Euroline can require special audits concerning the security of sensitive components. 6.3 Special regulations for Payment Service Providers If the Merchant uses a third party (a so-called Payment Service Provider) as part of its payment solution for processing Transactions, the Merchant must ensure that said third party complies with all of the requirements of PCI DSS. 6.4 Changes to equipment etc. The Merchant shall inform Euroline prior to every installation, relocation or decommissioning of equipment that is technically connected to Euroline or another collector of Transactions that acts on behalf of the Merchant within the framework of this agreement. Changes to Terminals affecting the conditions that applied at the time of approval may not be implemented without Euroline's consent. Before transactions are transferred to Euroline, the Merchant shall conduct a test specified by Euroline on said Merchant's connection to Euroline's receiving system. 6.6 Hacking and IT forensic investigation If Euroline suspects that the Merchant's point of sale, computer or other system has been subject to hacking, manipulation or the like that, in Euroline's assessment, in some way affects the Parties' cooperation under this Agreement, Euroline has the right to conduct a socalled IT forensic investigation of the concerned equipment. The investigation may be conducted by Euroline or an IT forensic company engaged by Euroline. The time, and related issues/procedures connected to the implementation of the Investigation, shall, unless Euroline deems it inappropriate, as far as possible be agreed between the Parties. If, however, Euroline deems it more appropriate, Euroline may visit the Merchant and conduct the Investigation without previously informing the Merchant. It falls to the Merchant to participate in the Investigation to a reasonable extent and facilitate its implementation so that the purpose of the Investigation, which is to determine whether hacking/manipulation has taken place, can be achieved. In cases where the Investigation determines that the Merchant's point of sale, computer or other system has been subject to hacking, manipulation or the like, the Merchant is obligated to at Euroline's request compensate Euroline for the costs of the Investigation. 7. Liability Shift Euroline employs so-called Liability Shift for Transactions, which means that the Merchant in its relation to Euroline under the Agreement is liable for all losses attributable to Transactions made by magnetic stripe with fraudulently manufactured cards where the

6 legitimate Card, that is, the Card issued by the authorised/licensed card issuer, with the same card number as the fraudulent card is equipped with a so-called EMV chip.